Does re-iterate AES128 with different keys gives any benefict?

I'm not cryptography expert (well, I'm here after all!) but I have this doubt…

Suppose I have 2 different keys:

1. secretkey1
2. secretkey2

And a plain text:

• myReallySecretPlainText

If I use AES128 on my plain text with my first key I get this:

U2FsdGVkX19fHxumDqEB9Kuyvhj+aoHpctLCdo2VEvt1danATMo+sBaz3nsCaS/Z


now, if I use on this cipher text my second key I got this:

U2FsdGVkX1/AqJ3w8nTRAHvm1ZbDTdwmq7LTVBDR/z4O9ngaXGuAIqcqTzPj+flPRIV6++twqBnIEHgUVVe7oO1D75VO14ezRX5tqcjBTPUUtr7YDqCks5ZW7fX8crqg


Looks pretty safe, but I have a doubt: does this have the same security of a AES256? Or a single 128bit key that can decode my final text can exists?

-
It's weaker than AES-256 against generic attacks. There is a meet in the middle attack which can break it with cost 2^128 (not sure how applicable the attack is with realistic cost models). See Attacking 2DES efficiently. Search for DES meet-in-the-middle for several related question. –  CodesInChaos Jan 29 '14 at 16:43
If you are going to do a double encryption, it is best to use different algorithms, and if possible different modes. For example, AES128-CTR(Twofish128-ECB(Plaintext,Key),Key,Nonce). This is extremely fast and allows "false length" outputs on the CTR wrap. –  Richie Frame Mar 25 '14 at 4:37

1 Answer

The idea you describe is vulnerable to a meet-in-the-middle attack that work in approximately $2^{128}$ time and $2^{128}$ memory. The attack assumes knowledge of plaintext/ciphertext pair(s). Given a pair, you encrypt the plaintext with every possible key 1 and store those values. You then decrypt the ciphertext with every possible key 2 and look for a match between the two datasets. Say you find that $E_{k_1}(P)=D_{k_2}(C)$. Likely these are your two keys. This can be validated by looking at additional plaintext/ciphertext pairs.

As codesinchaos says, the attack may not necessarily be applicable with realistic cost models, but it is a theoretical break and is therefore considered weaker than just using a larger key space in the first place. Also, I've got to believe that this idea is slower than just using AES-256.

-
Not that AES-256 is per se more secure than AES-128. –  Stephen Touset Jan 29 '14 at 18:55
@StephenTouset True, but it's very likely that it is more secure. The one big issue found so far is specific for related key attacks, which is not applicable in most protocols using AES. –  Maarten Bodewes Jan 29 '14 at 19:23
@mikeazo thank you for your answer! I want to use this "double aes128 method" because i have to cipher lot of things, with a double ciphering where the second key is always different i can make attacker's life more hard :) i remember something about the meet in the middle attack, looks like it can't be applied in this case due the impossibility to know a plaintext/ciphertext pairs since the key change for every element. Thank you again! –  AlexanderPD Jan 30 '14 at 8:00
@AlexanderPD, what sort of attack are you worried about?To be honest, if I saw "double aes128 method" used in a real world system, I would run away from it as fast as I could. While the attacks might be theoretical, it does not follow good design principles from a cryptographic prospective. Chances are, whatever attack you are worried about can be mitigated using standard cryptographic processes and procedures (or perhaps by something else). –  mikeazo Jan 30 '14 at 19:19